Antivirus software removes my backup .sql database file because wp_wfhits table.

  • Resolved iwanwilaga

    (@iwanwilaga)


    4 years, 5 months ago

    Hello, my antivirus software on my computer started to get triggered by the .sql file i regularly download as a WordPress backup. After further checking, i found that the triggering part was a script snippet placed into the wp_wfhits table by Wordfence plugin (i believe) about some bad guy’s website.

    Here i opened a question on this with more details, if in need: https://webmasters.stackexchange.com/questions/125894/wordpress-database-backup-sql-file-got-a-trojan-category-malware-treat-says/125930?noredirect=1#comment171350_125930

    I also send a feedback to Wordfence team, before i found this free forum. Here is the reply for your reference:

    The wfhits table stores all visits that are displayed on the Live Traffic tool page in our plugin.

    The domain balantfromsun [.] com is a known bad domain, which you can see here:
    ​
    https://www.virustotal.com/gui/url/003d9a8db5dddc08b6f365b2a9e9144341000caa0011d5f3cfc592401de16c0d/detection

    The rows in the table show that a cross-scripting attack involving this domain name was carried out on the site from which this database belongs to. The attack was blocked by Wordfence.

    It’s -obviously- all good and I’m happy that Wordfence managed to catch this specific XSS attack!

    My further question on this: is it possible to further improve the storage part of the malicious scripts/codes to as not to trigger antivirus software?
    Or what is the required procedure in these cases? It may cause (even) bigger headaches to users who aren’t able to research the exact triggering part themselves?

    Thank you!
    Viktor Boritas

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfphil

    (@wfphil)

    4 years, 5 months ago

    Hi @iwanwilaga

    You can create a storage directory on your computer and set that as a whitelisted directory in your anti-malware software so that when you download a backup of your database from the server it won’t be quarantined and/or deleted.

    Thread Starter iwanwilaga

    (@iwanwilaga)

    4 years, 5 months ago

    Hello,

    Isn’t that a counter-intuitive move? Especially regarding this list here: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=Wordfence&search_type=all

    Please, help me to get convinced that it’s a 100% safe ‘tactics’ that you are suggesting here.
    Cheers, Viktor

    Plugin Support wfphil

    (@wfphil)

    4 years, 5 months ago

    Hi @iwanwilaga

    I don’t understand what you think is counter-intuitive so please explain.

    I also don’t understand the relevance of the NIST link either if you can explain that too please. In case you are referring to CVE-2019-9669 that is a complete non-issue which you can read about here from our CEO:

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Antivirus software removes my backup .sql database file because wp_wfhits table.’ is closed to new replies.

Tags